Skip to content

adjust feature flag #4050

adjust feature flag

adjust feature flag #4050

Workflow file for this run

---
name: push workflow
on:
push:
branches-ignore:
- dependabot/**
pull_request:
types: [labeled]
permissions:
contents: read
jobs:
build_and_push_docker:
# this basically means do not execute it as dependabot unless it is labeled as ready-for-ci
# because automated processes and pr from forks are dangerous, therefore those prs won't have access to secrets, labeling them acts like allow-listing them
# more details here https://docs.github.com/en/rest/dependabot/secrets?apiVersion=2022-11-28
# even when re-running an action manually the actor stays the same as of mid 2022, details here https://github.blog/changelog/2022-07-19-differentiating-triggering-actor-from-executing-actor/
#https://github.com/actions/runner/issues/1173#issuecomment-1354501147 when false equals true, you have to come up with something ...
if: |
(github.actor == 'dependabot[bot]' &&
contains(github.event.issue.labels.*.name, 'ready-for-ci') == 'true') ||
github.actor != 'dependabot[bot]'
runs-on: ubuntu-latest
needs:
- branch_meta
permissions:
packages: write
strategy:
matrix:
tenants: [default, brb, n21, thr ]
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Docker meta Service Name
id: docker_meta_img
uses: docker/metadata-action@v4
with:
images: ghcr.io/${{ github.repository }}-${{ matrix.tenants }}
tags: |
type=ref,event=branch,enable=false,priority=600
type=sha,enable=true,priority=600,prefix=
- name: Log into registry
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: test image exists
run: |
echo "IMAGE_EXISTS=$(docker manifest inspect ghcr.io/${{ github.repository }}-${{ matrix.tenants }}:${{ needs.branch_meta.outputs.sha }} > /dev/null && echo 1 || echo 0)" >> $GITHUB_ENV
- name: Set up Docker Buildx
if: ${{ env.IMAGE_EXISTS == 0 }}
uses: docker/setup-buildx-action@v2
- name: Build and push ${{ github.repository }}
if: ${{ env.IMAGE_EXISTS == 0 }}
uses: docker/build-push-action@v4
with:
build-args: |
SC_THEME_BUILD=${{ matrix.tenants }}
context: .
file: ./Dockerfile
platforms: linux/amd64
push: true
tags: ghcr.io/${{ github.repository }}-${{ matrix.tenants }}:${{ needs.branch_meta.outputs.sha }}
labels: ${{ steps.docker_meta_img.outputs.labels }}
- name: Send Notification to Rocket Chat if docker image build failed
if: ${{ failure() && github.ref == 'refs/heads/main' }}
uses: RocketChat/[email protected]
with:
type: ${{ job.status }}
job_name: "docker image build from ${{ github.repository }} triggered from branch ${{ github.ref_name }}:"
url: ${{ secrets.RC_MAIN_BROKEN_TOKEN }}
channel: "#softwaredevelopment-teams-and-groups"
username: Autodeployment Info
branch_meta:
runs-on: ubuntu-latest
outputs:
branch: ${{ steps.extract_branch_meta.outputs.branch }}
sha: ${{ steps.extract_branch_meta.outputs.sha }}
steps:
- name: Extract branch name
shell: bash
id: extract_branch_meta
run: |
if [ "${{ github.event_name }}" == 'pull_request' ]; then
echo "branch=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT
echo "sha=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
else
echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
echo "sha=${{ github.sha }}" >> $GITHUB_OUTPUT
fi
deploy:
needs:
- build_and_push_docker
- branch_meta
uses: hpi-schul-cloud/dof_app_deploy/.github/workflows/deploy.yml@main
with:
branch: ${{ needs.branch_meta.outputs.branch }}
secrets:
token: ${{ secrets.GITHUB_TOKEN }}
DEV_VAULT: ${{ secrets.DEV_VAULT }}
DEV_KUBE_CONFIG: ${{ secrets.DEV_KUBE_CONFIG }}
BINGO_REPO_TOKEN: ${{ secrets.BINGO_REPO_TOKEN }}
deploy-successful:
needs:
- deploy
runs-on: ubuntu-latest
steps:
- run: echo "deploy was successful"
trivy-vulnerability-scanning:
needs:
- build_and_push_docker
- branch_meta
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: run trivy vulnerability scanner
uses: aquasecurity/trivy-action@9ab158e8597f3b310480b9a69402b419bc03dbd5
with:
image-ref: 'ghcr.io/${{ github.repository }}-default:${{ needs.branch_meta.outputs.sha }}'
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
ignore-unfixed: true
- name: upload trivy results
if: ${{ always() }}
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
end-to-end-tests:
needs:
- build_and_push_docker
- branch_meta
uses: hpi-schul-cloud/end-to-end-tests/.github/workflows/e2e_call.yml@main
with:
ref: ${{ needs.branch_meta.outputs.branch }}
cy-e2e-tests:
needs:
- branch_meta
- deploy
uses: hpi-schul-cloud/e2e-system-tests/.github/workflows/remote-trigger.yml@main
with:
ref: ${{ needs.branch_meta.outputs.branch }}
secrets:
service-account-token: ${{ secrets.CYPRESS_ONEPWD_SERVICE_ACCOUNT_TOKEN }}
test-successful:
runs-on: ubuntu-latest
needs:
- end-to-end-tests
steps:
- run: echo "Test was successful"